Attack trying common passwords against many accounts simultaneously. Avoids lockouts by limiting attempts per account. Effective against weak password policies.